Back to Guides

Status: EXPERIMENTAL · Community-contributed · No named domain co-maintainer · Output requires review by qualified UK FS regulatory counsel, the firm's MLRO / Compliance Officer, and the SMF holder with primary accountability for payment services before any reliance on generated artefacts. Regulatory citations reflect the position at the time each command was authored; verify against current FCA, BoE, PRA, and legislation.gov.uk publications before reliance.

Purpose

The UK Finance Payments Overlay is the first sector-specific ArcKit overlay. Where the jurisdiction overlays (UAE, France, Canada, EU, Austria, Australia, USA) replace or supplement the UK governance framework for a different legal territory, this overlay stays within the UK but narrows the regulatory focus to the payments and e-money sector — authorised Payment Service Providers (PSPs), Electronic Money Institutions (EMIs), Authorised Payment Institutions (APIs), and the registered Small Payment Institutions (SPIs) that may opt into safeguarding voluntarily.

The v1 scope covers the UK payments slice that applies to established PSPs and EMIs already holding their FCA authorisation and now building or re-architecting a product on top of that authorisation. It does not replicate the authorisation application process itself; it produces the architecture and compliance artefacts that a firm needs once authorised — and that the FCA expects to find during supervisory engagement.

When to Use

Use the overlay if any of the following describe the project:

  • Building a new product on an existing FCA authorisation — adding a new payment rail, a new card-present exemption design, a virtual account product, or a cross-border FX offering to a firm already authorised under PSRs 2017 or EMR 2011.
  • Refreshing artefacts after a regulatory change — FCA PS25/12 (safeguarding reforms: CASS 15 and the monthly safeguarding return, in force 7 May 2026), PS24/16 (Critical Third Parties, effective January 2025), or an SCA-RTS amendment such as FCA 2025/62 (risk-based contactless exemption, in force 19 March 2026) has changed an obligation and the firm's compliance documentation needs updating.
  • Preparing for FCA supervisory engagement — an FCA skilled-person review (s166), a Dear CEO letter response, or a monthly safeguarding return audit trail requires the firm to produce structured, traceable compliance documentation.
  • Onboarding an architecture team to payments compliance — the commands produce teaching artefacts that ground architects and engineers in the regulatory anchors without requiring them to read each primary instrument from scratch.

For non-payments projects, the overlay is dormant: existing baseline ArcKit commands (risk, dpia, requirements, adr, etc.) are unchanged. For cross-border EU operations, the EU overlay handles the PSD3 / EU SCA-RTS trajectory; this overlay covers the post-Brexit UK SCA-RTS divergence specifically.

Prerequisites

Before running the commands:

  • The project must be scaffolded via /arckit:init. A projects/ directory must exist.
  • The baseline artefacts (PRIN, STKE, REQ, RISK) ideally exist before running the overlay commands — each overlay command reads them for context. They do not need to be final; draft versions are sufficient.
  • The plugin userConfig should have governance_framework set to UK Gov and default_classification set appropriately (PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE for most payments artefacts; check with counsel for any that contain firm-sensitive commercial data).
  • No additional userConfig keys are required for this overlay beyond the core plugin defaults.

The 4 Commands

/arckit:uk-fs-sca-rts — SCA-RTS Exemption Design

Generates an SCA-RTS exemption design pack for an authorised PSP, EMI, or PI subject to the Payment Services Regulations 2017 and the FCA's Technical Standards on Strong Customer Authentication and Common and Secure Methods of Communication (the UK SCA-RTS, made under PSRs 2017 regulation 106A and amended by PS21/19 and FCA 2025/62). The artefact covers: an exemption applicability matrix for all ten exemptions — Articles 10, 10A, 11, 12 (unattended terminals for transport fares and parking fees), 13, 14, 15, 16, 17 and 18; Transaction Risk Analysis (TRA) reference fraud rates and exemption threshold values under Articles 18 and 19, with the Article 20 cessation rule; authentication architecture (knowledge / possession / inherence factor inventory; dynamic linking implementation); fraud monitoring framework including Article 20 reporting, Article 21 monitoring and MLRO notification triggers; and audit trail requirements. Doc-type code: FSSCA. Principal citations: PSRs 2017 SI 2017/752; the UK SCA-RTS in the FCA Handbook; FCA PS21/19; FCA 2025/62; the FCA Approach Document (May 2026).

/arckit:uk-fs-safeguarding — EMI / PI Safeguarding Assessment

Generates a safeguarding assessment for an authorised EMI or API (or an SPI that voluntarily safeguards) under EMR 2011 Reg 20–22 and PSRs 2017 Reg 23. The artefact covers: safeguarding method statement (segregation in a designated bank account, comparable insurance policy, or comparable guarantee — with full justification for the chosen method); designated safeguarding bank or insurer details; end-to-end client-funds flow diagram; daily reconciliation framework (CASS 15.8.19R and 15.8.42R) with a four-tier sign-off chain; and an audit plan aligned to SUP 3A safeguarding audits and the monthly safeguarding return (REP027: SUP 16.14A, content in SUP 16 Annex 29BR — one return for payment institutions and EMIs). Failure scenarios and recovery plans are required sections. Doc-type code: FSSAFE (CRITICAL severity). Principal citations: EMR 2011 SI 2011/99; PSRs 2017 SI 2017/752; FCA PS25/12 and CASS 15 (in force 7 May 2026); FCA Approach Document (May 2026).

/arckit:uk-fs-consumer-duty — Consumer Duty Annual Board Report

Generates an FCA Consumer Duty Annual Board Report covering the four Consumer Duty outcomes introduced by PS22/9 (in force July 2023 for open products, July 2024 for closed products) and anchored on FCA Principle 12 and PRIN 2A. The artefact covers: per-outcome evidence assessment (Products and Services, Price and Value, Consumer Understanding, Consumer Support); fair-value framework; target market assessment; vulnerable customer cohort identification using the FG22/5 four vulnerability drivers (health, life events, resilience, capability); foreseeable harms register; and a board attestation block for SMF holder sign-off. Doc-type code: FSCD. Principal citations: FCA PS22/9; FCA FG22/5; FCA "Consumer Duty board reports: good practice and areas for improvement" (11 December 2024, last updated 9 March 2026); FCA blog "Year 2 Consumer Duty Board Reports: progress and what comes next" (16 April 2026); FCA PRIN 2A via FCA 2022/31.

/arckit:uk-fs-ctp-dependency — Critical Third Party Dependency Assessment

Generates a CTP dependency register and resilience testing plan under the BoE/PRA/FCA CTP regime established by PS24/16 (effective January 2025) and grounded in the Financial Services and Markets Act 2023. The artefact covers: identification of designated CTPs and material non-CTPs (cloud hyperscalers, payment networks, BaaS providers); a four-dimension materiality scoring framework (IBS dependency, substitution difficulty, recovery time impact, concentration risk contribution); Nth-party (sub-contractor) dependency framing; concentration risk analysis across geographic, vendor, and functional dimensions; and a resilience testing plan including exit and substitution drills. The designated CTP list is still maturing — verify via the HMT publication page before reliance. Doc-type code: FSCTP. Principal citations: FCA PS24/16; FSMA 2023; FCA 2024/41 CTP Sourcebook instrument; HMT designation approach document (March 2024).

Recipe

The overlay ships with the uk-fs-payments recipe, which orchestrates 11 build targets across baseline and overlay commands in a structured wave sequence:

  • Wave 1 (foundation): PRIN, STKE
  • Wave 2 (requirements + risk): REQ, RISK
  • Wave 3 (payments overlay — parallel where possible): FSSCA, FSSAFE, FSCD, FSCTP
  • Wave 4 (cross-cutting): DPIA, ADR, traceability

To run:

# In a Claude Code session with the ArcKit plugin and UK Finance overlay enabled:
/arckit:build <project-name> --recipe uk-fs-payments --plan   # wave-plan dry run
/arckit:build <project-name> --recipe uk-fs-payments          # full build

The recipe is defined in plugins/arckit-uk-finance/recipes/uk-fs-payments.yaml.

Doc-type Codes

Code Artefact name Severity
FSSCA SCA-RTS Exemption Design Standard
FSSAFE Safeguarding Assessment CRITICAL
FSCD Consumer Duty Board Report Standard
FSCTP CTP Dependency Assessment Standard

FSSAFE carries CRITICAL severity because safeguarding failures have led to firm collapse and FCA enforcement action — Allied Wallet (2021) and Premier FX (2018) are the documented enforcement cases. The CRITICAL marker signals that the artefact requires elevated sign-off and more frequent review than standard compliance artefacts.

v2 Candidates

The following commands were designed during the v1 scoping exercise but deferred to a future version to keep the v1 surface area focused:

  • uk-fs-payments-or — operational resilience important business services (IBS) mapping and impact tolerance setting under the FCA/PRA operational resilience framework (effective March 2022). Complements uk-fs-ctp-dependency; deferred because the two overlap significantly and the CTP dependency is the more immediate FCA focus for most PSPs/EMIs.
  • uk-fs-app-fraud — APP fraud reimbursement obligations under the PSR's mandatory reimbursement policy (effective October 2024) and Confirmation of Payee (CoP) scheme rules. A high-priority v2 candidate given the PSR's active supervisory focus.
  • uk-fs-aml-reg18 — MLR 2017 firm-wide risk assessment under Regulation 18. Addresses the MLRO and AML-angle that the current commands touch only at their periphery.
  • uk-fs-dora-mapping — DORA mapping for UK firms with EU operations subject to the EU Digital Operational Resilience Act. Relevant for firms with EU-regulated entities that need to align their CTP dependency assessment with DORA's ICT third-party risk requirements.
  • Open Banking conformance commands (TPP-focused) — API conformance testing evidence, Directory enrolment artefacts, FAPI 1.0 Advanced profile mapping. Candidate for a separate arckit-uk-open-banking overlay rather than inclusion in the payments overlay.

Status

EXPERIMENTAL. This overlay has not been validated against a live FCA supervisory review or skilled-person (s166) engagement. The regulatory anchors are verified at the time of authoring; re-verify before production reliance. Quarterly review cadence is the target once a domain co-maintainer is in place.

Help wanted — domain co-maintainer. The overlay is seeking a UK payments / e-money SME co-maintainer. Relevant backgrounds include FCA-authorised payments firm compliance leads, payment services solicitors, Big Four FS regulatory advisers, and architects with direct FCA supervisory engagement experience. If you are interested, open an issue with the label co-maintainer: uk-finance or DM @tractorjuice.

Co-maintainer recruitment is a precondition for re-evaluating the overlay for official-baseline promotion.

References

The following URLs are the principal regulatory sources used across the overlay's commands. All were verified as live at the time the commands were authored.